The most important architectural decision in Polinaria Home is what it refuses to claim. Home can display applications, collect requests, and record policy, but its local database is not treated as proof that someone has access elsewhere. A card becomes available only after the identity control plane confirms the corresponding baseline entitlement.

That separation prevents the friendly launcher from becoming an accidental source of excessive authority. Home sends a narrowly scoped application-and-action request. The identity service resolves the private role mapping, while the destination application still decides what the signed-in person may do within its own boundary. Catalog data shown to ordinary users omits privileged project and role identifiers.

The integration is designed to fail honestly. Before changing identity or access, Home verifies a versioned capability contract and correlates the request across the boundary. Missing, partial, mismatched, denied, or timed-out capabilities do not become optimistic success. They remain visible as retryable or incompatible states, preserving the difference between “we intended to grant access” and “the other system confirmed it.”

Administrative changes also leave an append-only trail, and consequential actions require explicit confirmation. This design gives Home a useful human role—welcome people, explain what exists, and coordinate access—without collapsing identity, authorization, application policy, and user experience into one unreviewable service.